ACE -- An Anomaly Contribution Explainer for Cyber-Security Applications

TL;DR

ACE and ACE-KL are tools that explain security anomaly detection models by identifying key features contributing to anomalies, aiding analysts in understanding and diagnosing security threats.

Contribution

The paper introduces ACE and ACE-KL, novel methods for explaining anomaly detection models in cybersecurity using a regression framework, with demonstrated effectiveness on multiple datasets.

Findings

Accurately identify contributing features in synthetic data with known ground truth

Effectively highlight key anomaly contributors in real-world datasets

Assist security analysts in uncovering previously overlooked security activities

Abstract

In this paper, we introduce Anomaly Contribution Explainer or ACE, a tool to explain security anomaly detection models in terms of the model features through a regression framework, and its variant, ACE-KL, which highlights the important anomaly contributors. ACE and ACE-KL provide insights in diagnosing which attributes significantly contribute to an anomaly by building a specialized linear model to locally approximate the anomaly score that a black-box model generates. We conducted experiments with these anomaly detection models to detect security anomalies on both synthetic data and real data. In particular, we evaluate performance on three public data sets: CERT insider threat, netflow logs, and Android malware. The experimental results are encouraging: our methods consistently identify the correct contributing feature in the synthetic data where ground truth is available; similarly, for real data sets, our methods point a security analyst in the direction of the underlying causes of an anomaly, including in one case leading to the discovery of previously overlooked network scanning activity. We have made our source code publicly available.